mirror of
https://github.com/llvm/llvm-project.git
synced 2025-05-09 18:46:05 +00:00
acd080b956
When casting the address of a FunctionTextRegion to bool, or when adding constraints to such an address, use a stand-in symbol to represent the presence or absence of the function if the function is weakly linked. This is groundwork for possible simple availability testing checks, and can already catch mistakes involving inverted null checks for weakly-linked functions. Currently, the implementation reuses the "extent" symbols, originally created for tracking the size of a malloc region. Since FunctionTextRegions cannot be dereferenced, the extent symbol will never be used for anything else. Still, this probably deserves a refactoring in the future. This patch does not attempt to support testing the presence of weak /variables/ (global variables), which would likely require much more of a change and a generalization of "region structure metadata", like the current "extents", vs. "region contents metadata", like CStringChecker's "string length". Patch by Richard <tarka.t.otter@googlemail.com>! llvm-svn: 189492
555 lines
15 KiB
C++
555 lines
15 KiB
C++
//== SymbolManager.h - Management of Symbolic Values ------------*- C++ -*--==//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This file defines SymbolManager, a class that manages symbolic values
|
|
// created for use by ExprEngine and related classes.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
|
|
#include "clang/Analysis/Analyses/LiveVariables.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
|
|
#include "llvm/Support/raw_ostream.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
|
|
void SymExpr::anchor() { }
|
|
|
|
void SymExpr::dump() const {
|
|
dumpToStream(llvm::errs());
|
|
}
|
|
|
|
void SymIntExpr::dumpToStream(raw_ostream &os) const {
|
|
os << '(';
|
|
getLHS()->dumpToStream(os);
|
|
os << ") "
|
|
<< BinaryOperator::getOpcodeStr(getOpcode()) << ' '
|
|
<< getRHS().getZExtValue();
|
|
if (getRHS().isUnsigned())
|
|
os << 'U';
|
|
}
|
|
|
|
void IntSymExpr::dumpToStream(raw_ostream &os) const {
|
|
os << getLHS().getZExtValue();
|
|
if (getLHS().isUnsigned())
|
|
os << 'U';
|
|
os << ' '
|
|
<< BinaryOperator::getOpcodeStr(getOpcode())
|
|
<< " (";
|
|
getRHS()->dumpToStream(os);
|
|
os << ')';
|
|
}
|
|
|
|
void SymSymExpr::dumpToStream(raw_ostream &os) const {
|
|
os << '(';
|
|
getLHS()->dumpToStream(os);
|
|
os << ") "
|
|
<< BinaryOperator::getOpcodeStr(getOpcode())
|
|
<< " (";
|
|
getRHS()->dumpToStream(os);
|
|
os << ')';
|
|
}
|
|
|
|
void SymbolCast::dumpToStream(raw_ostream &os) const {
|
|
os << '(' << ToTy.getAsString() << ") (";
|
|
Operand->dumpToStream(os);
|
|
os << ')';
|
|
}
|
|
|
|
void SymbolConjured::dumpToStream(raw_ostream &os) const {
|
|
os << "conj_$" << getSymbolID() << '{' << T.getAsString() << '}';
|
|
}
|
|
|
|
void SymbolDerived::dumpToStream(raw_ostream &os) const {
|
|
os << "derived_$" << getSymbolID() << '{'
|
|
<< getParentSymbol() << ',' << getRegion() << '}';
|
|
}
|
|
|
|
void SymbolExtent::dumpToStream(raw_ostream &os) const {
|
|
os << "extent_$" << getSymbolID() << '{' << getRegion() << '}';
|
|
}
|
|
|
|
void SymbolMetadata::dumpToStream(raw_ostream &os) const {
|
|
os << "meta_$" << getSymbolID() << '{'
|
|
<< getRegion() << ',' << T.getAsString() << '}';
|
|
}
|
|
|
|
void SymbolData::anchor() { }
|
|
|
|
void SymbolRegionValue::dumpToStream(raw_ostream &os) const {
|
|
os << "reg_$" << getSymbolID() << "<" << R << ">";
|
|
}
|
|
|
|
bool SymExpr::symbol_iterator::operator==(const symbol_iterator &X) const {
|
|
return itr == X.itr;
|
|
}
|
|
|
|
bool SymExpr::symbol_iterator::operator!=(const symbol_iterator &X) const {
|
|
return itr != X.itr;
|
|
}
|
|
|
|
SymExpr::symbol_iterator::symbol_iterator(const SymExpr *SE) {
|
|
itr.push_back(SE);
|
|
}
|
|
|
|
SymExpr::symbol_iterator &SymExpr::symbol_iterator::operator++() {
|
|
assert(!itr.empty() && "attempting to iterate on an 'end' iterator");
|
|
expand();
|
|
return *this;
|
|
}
|
|
|
|
SymbolRef SymExpr::symbol_iterator::operator*() {
|
|
assert(!itr.empty() && "attempting to dereference an 'end' iterator");
|
|
return itr.back();
|
|
}
|
|
|
|
void SymExpr::symbol_iterator::expand() {
|
|
const SymExpr *SE = itr.pop_back_val();
|
|
|
|
switch (SE->getKind()) {
|
|
case SymExpr::RegionValueKind:
|
|
case SymExpr::ConjuredKind:
|
|
case SymExpr::DerivedKind:
|
|
case SymExpr::ExtentKind:
|
|
case SymExpr::MetadataKind:
|
|
return;
|
|
case SymExpr::CastSymbolKind:
|
|
itr.push_back(cast<SymbolCast>(SE)->getOperand());
|
|
return;
|
|
case SymExpr::SymIntKind:
|
|
itr.push_back(cast<SymIntExpr>(SE)->getLHS());
|
|
return;
|
|
case SymExpr::IntSymKind:
|
|
itr.push_back(cast<IntSymExpr>(SE)->getRHS());
|
|
return;
|
|
case SymExpr::SymSymKind: {
|
|
const SymSymExpr *x = cast<SymSymExpr>(SE);
|
|
itr.push_back(x->getLHS());
|
|
itr.push_back(x->getRHS());
|
|
return;
|
|
}
|
|
}
|
|
llvm_unreachable("unhandled expansion case");
|
|
}
|
|
|
|
unsigned SymExpr::computeComplexity() const {
|
|
unsigned R = 0;
|
|
for (symbol_iterator I = symbol_begin(), E = symbol_end(); I != E; ++I)
|
|
R++;
|
|
return R;
|
|
}
|
|
|
|
const SymbolRegionValue*
|
|
SymbolManager::getRegionValueSymbol(const TypedValueRegion* R) {
|
|
llvm::FoldingSetNodeID profile;
|
|
SymbolRegionValue::Profile(profile, R);
|
|
void *InsertPos;
|
|
SymExpr *SD = DataSet.FindNodeOrInsertPos(profile, InsertPos);
|
|
if (!SD) {
|
|
SD = (SymExpr*) BPAlloc.Allocate<SymbolRegionValue>();
|
|
new (SD) SymbolRegionValue(SymbolCounter, R);
|
|
DataSet.InsertNode(SD, InsertPos);
|
|
++SymbolCounter;
|
|
}
|
|
|
|
return cast<SymbolRegionValue>(SD);
|
|
}
|
|
|
|
const SymbolConjured* SymbolManager::conjureSymbol(const Stmt *E,
|
|
const LocationContext *LCtx,
|
|
QualType T,
|
|
unsigned Count,
|
|
const void *SymbolTag) {
|
|
llvm::FoldingSetNodeID profile;
|
|
SymbolConjured::Profile(profile, E, T, Count, LCtx, SymbolTag);
|
|
void *InsertPos;
|
|
SymExpr *SD = DataSet.FindNodeOrInsertPos(profile, InsertPos);
|
|
if (!SD) {
|
|
SD = (SymExpr*) BPAlloc.Allocate<SymbolConjured>();
|
|
new (SD) SymbolConjured(SymbolCounter, E, LCtx, T, Count, SymbolTag);
|
|
DataSet.InsertNode(SD, InsertPos);
|
|
++SymbolCounter;
|
|
}
|
|
|
|
return cast<SymbolConjured>(SD);
|
|
}
|
|
|
|
const SymbolDerived*
|
|
SymbolManager::getDerivedSymbol(SymbolRef parentSymbol,
|
|
const TypedValueRegion *R) {
|
|
|
|
llvm::FoldingSetNodeID profile;
|
|
SymbolDerived::Profile(profile, parentSymbol, R);
|
|
void *InsertPos;
|
|
SymExpr *SD = DataSet.FindNodeOrInsertPos(profile, InsertPos);
|
|
if (!SD) {
|
|
SD = (SymExpr*) BPAlloc.Allocate<SymbolDerived>();
|
|
new (SD) SymbolDerived(SymbolCounter, parentSymbol, R);
|
|
DataSet.InsertNode(SD, InsertPos);
|
|
++SymbolCounter;
|
|
}
|
|
|
|
return cast<SymbolDerived>(SD);
|
|
}
|
|
|
|
const SymbolExtent*
|
|
SymbolManager::getExtentSymbol(const SubRegion *R) {
|
|
llvm::FoldingSetNodeID profile;
|
|
SymbolExtent::Profile(profile, R);
|
|
void *InsertPos;
|
|
SymExpr *SD = DataSet.FindNodeOrInsertPos(profile, InsertPos);
|
|
if (!SD) {
|
|
SD = (SymExpr*) BPAlloc.Allocate<SymbolExtent>();
|
|
new (SD) SymbolExtent(SymbolCounter, R);
|
|
DataSet.InsertNode(SD, InsertPos);
|
|
++SymbolCounter;
|
|
}
|
|
|
|
return cast<SymbolExtent>(SD);
|
|
}
|
|
|
|
const SymbolMetadata*
|
|
SymbolManager::getMetadataSymbol(const MemRegion* R, const Stmt *S, QualType T,
|
|
unsigned Count, const void *SymbolTag) {
|
|
|
|
llvm::FoldingSetNodeID profile;
|
|
SymbolMetadata::Profile(profile, R, S, T, Count, SymbolTag);
|
|
void *InsertPos;
|
|
SymExpr *SD = DataSet.FindNodeOrInsertPos(profile, InsertPos);
|
|
if (!SD) {
|
|
SD = (SymExpr*) BPAlloc.Allocate<SymbolMetadata>();
|
|
new (SD) SymbolMetadata(SymbolCounter, R, S, T, Count, SymbolTag);
|
|
DataSet.InsertNode(SD, InsertPos);
|
|
++SymbolCounter;
|
|
}
|
|
|
|
return cast<SymbolMetadata>(SD);
|
|
}
|
|
|
|
const SymbolCast*
|
|
SymbolManager::getCastSymbol(const SymExpr *Op,
|
|
QualType From, QualType To) {
|
|
llvm::FoldingSetNodeID ID;
|
|
SymbolCast::Profile(ID, Op, From, To);
|
|
void *InsertPos;
|
|
SymExpr *data = DataSet.FindNodeOrInsertPos(ID, InsertPos);
|
|
if (!data) {
|
|
data = (SymbolCast*) BPAlloc.Allocate<SymbolCast>();
|
|
new (data) SymbolCast(Op, From, To);
|
|
DataSet.InsertNode(data, InsertPos);
|
|
}
|
|
|
|
return cast<SymbolCast>(data);
|
|
}
|
|
|
|
const SymIntExpr *SymbolManager::getSymIntExpr(const SymExpr *lhs,
|
|
BinaryOperator::Opcode op,
|
|
const llvm::APSInt& v,
|
|
QualType t) {
|
|
llvm::FoldingSetNodeID ID;
|
|
SymIntExpr::Profile(ID, lhs, op, v, t);
|
|
void *InsertPos;
|
|
SymExpr *data = DataSet.FindNodeOrInsertPos(ID, InsertPos);
|
|
|
|
if (!data) {
|
|
data = (SymIntExpr*) BPAlloc.Allocate<SymIntExpr>();
|
|
new (data) SymIntExpr(lhs, op, v, t);
|
|
DataSet.InsertNode(data, InsertPos);
|
|
}
|
|
|
|
return cast<SymIntExpr>(data);
|
|
}
|
|
|
|
const IntSymExpr *SymbolManager::getIntSymExpr(const llvm::APSInt& lhs,
|
|
BinaryOperator::Opcode op,
|
|
const SymExpr *rhs,
|
|
QualType t) {
|
|
llvm::FoldingSetNodeID ID;
|
|
IntSymExpr::Profile(ID, lhs, op, rhs, t);
|
|
void *InsertPos;
|
|
SymExpr *data = DataSet.FindNodeOrInsertPos(ID, InsertPos);
|
|
|
|
if (!data) {
|
|
data = (IntSymExpr*) BPAlloc.Allocate<IntSymExpr>();
|
|
new (data) IntSymExpr(lhs, op, rhs, t);
|
|
DataSet.InsertNode(data, InsertPos);
|
|
}
|
|
|
|
return cast<IntSymExpr>(data);
|
|
}
|
|
|
|
const SymSymExpr *SymbolManager::getSymSymExpr(const SymExpr *lhs,
|
|
BinaryOperator::Opcode op,
|
|
const SymExpr *rhs,
|
|
QualType t) {
|
|
llvm::FoldingSetNodeID ID;
|
|
SymSymExpr::Profile(ID, lhs, op, rhs, t);
|
|
void *InsertPos;
|
|
SymExpr *data = DataSet.FindNodeOrInsertPos(ID, InsertPos);
|
|
|
|
if (!data) {
|
|
data = (SymSymExpr*) BPAlloc.Allocate<SymSymExpr>();
|
|
new (data) SymSymExpr(lhs, op, rhs, t);
|
|
DataSet.InsertNode(data, InsertPos);
|
|
}
|
|
|
|
return cast<SymSymExpr>(data);
|
|
}
|
|
|
|
QualType SymbolConjured::getType() const {
|
|
return T;
|
|
}
|
|
|
|
QualType SymbolDerived::getType() const {
|
|
return R->getValueType();
|
|
}
|
|
|
|
QualType SymbolExtent::getType() const {
|
|
ASTContext &Ctx = R->getMemRegionManager()->getContext();
|
|
return Ctx.getSizeType();
|
|
}
|
|
|
|
QualType SymbolMetadata::getType() const {
|
|
return T;
|
|
}
|
|
|
|
QualType SymbolRegionValue::getType() const {
|
|
return R->getValueType();
|
|
}
|
|
|
|
SymbolManager::~SymbolManager() {
|
|
for (SymbolDependTy::const_iterator I = SymbolDependencies.begin(),
|
|
E = SymbolDependencies.end(); I != E; ++I) {
|
|
delete I->second;
|
|
}
|
|
|
|
}
|
|
|
|
bool SymbolManager::canSymbolicate(QualType T) {
|
|
T = T.getCanonicalType();
|
|
|
|
if (Loc::isLocType(T))
|
|
return true;
|
|
|
|
if (T->isIntegralOrEnumerationType())
|
|
return true;
|
|
|
|
if (T->isRecordType() && !T->isUnionType())
|
|
return true;
|
|
|
|
return false;
|
|
}
|
|
|
|
void SymbolManager::addSymbolDependency(const SymbolRef Primary,
|
|
const SymbolRef Dependent) {
|
|
SymbolDependTy::iterator I = SymbolDependencies.find(Primary);
|
|
SymbolRefSmallVectorTy *dependencies = 0;
|
|
if (I == SymbolDependencies.end()) {
|
|
dependencies = new SymbolRefSmallVectorTy();
|
|
SymbolDependencies[Primary] = dependencies;
|
|
} else {
|
|
dependencies = I->second;
|
|
}
|
|
dependencies->push_back(Dependent);
|
|
}
|
|
|
|
const SymbolRefSmallVectorTy *SymbolManager::getDependentSymbols(
|
|
const SymbolRef Primary) {
|
|
SymbolDependTy::const_iterator I = SymbolDependencies.find(Primary);
|
|
if (I == SymbolDependencies.end())
|
|
return 0;
|
|
return I->second;
|
|
}
|
|
|
|
void SymbolReaper::markDependentsLive(SymbolRef sym) {
|
|
// Do not mark dependents more then once.
|
|
SymbolMapTy::iterator LI = TheLiving.find(sym);
|
|
assert(LI != TheLiving.end() && "The primary symbol is not live.");
|
|
if (LI->second == HaveMarkedDependents)
|
|
return;
|
|
LI->second = HaveMarkedDependents;
|
|
|
|
if (const SymbolRefSmallVectorTy *Deps = SymMgr.getDependentSymbols(sym)) {
|
|
for (SymbolRefSmallVectorTy::const_iterator I = Deps->begin(),
|
|
E = Deps->end(); I != E; ++I) {
|
|
if (TheLiving.find(*I) != TheLiving.end())
|
|
continue;
|
|
markLive(*I);
|
|
}
|
|
}
|
|
}
|
|
|
|
void SymbolReaper::markLive(SymbolRef sym) {
|
|
TheLiving[sym] = NotProcessed;
|
|
TheDead.erase(sym);
|
|
markDependentsLive(sym);
|
|
}
|
|
|
|
void SymbolReaper::markLive(const MemRegion *region) {
|
|
RegionRoots.insert(region);
|
|
}
|
|
|
|
void SymbolReaper::markInUse(SymbolRef sym) {
|
|
if (isa<SymbolMetadata>(sym))
|
|
MetadataInUse.insert(sym);
|
|
}
|
|
|
|
bool SymbolReaper::maybeDead(SymbolRef sym) {
|
|
if (isLive(sym))
|
|
return false;
|
|
|
|
TheDead.insert(sym);
|
|
return true;
|
|
}
|
|
|
|
bool SymbolReaper::isLiveRegion(const MemRegion *MR) {
|
|
if (RegionRoots.count(MR))
|
|
return true;
|
|
|
|
MR = MR->getBaseRegion();
|
|
|
|
if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
|
|
return isLive(SR->getSymbol());
|
|
|
|
if (const VarRegion *VR = dyn_cast<VarRegion>(MR))
|
|
return isLive(VR, true);
|
|
|
|
// FIXME: This is a gross over-approximation. What we really need is a way to
|
|
// tell if anything still refers to this region. Unlike SymbolicRegions,
|
|
// AllocaRegions don't have associated symbols, though, so we don't actually
|
|
// have a way to track their liveness.
|
|
if (isa<AllocaRegion>(MR))
|
|
return true;
|
|
|
|
if (isa<CXXThisRegion>(MR))
|
|
return true;
|
|
|
|
if (isa<MemSpaceRegion>(MR))
|
|
return true;
|
|
|
|
if (isa<CodeTextRegion>(MR))
|
|
return true;
|
|
|
|
return false;
|
|
}
|
|
|
|
bool SymbolReaper::isLive(SymbolRef sym) {
|
|
if (TheLiving.count(sym)) {
|
|
markDependentsLive(sym);
|
|
return true;
|
|
}
|
|
|
|
bool KnownLive;
|
|
|
|
switch (sym->getKind()) {
|
|
case SymExpr::RegionValueKind:
|
|
KnownLive = isLiveRegion(cast<SymbolRegionValue>(sym)->getRegion());
|
|
break;
|
|
case SymExpr::ConjuredKind:
|
|
KnownLive = false;
|
|
break;
|
|
case SymExpr::DerivedKind:
|
|
KnownLive = isLive(cast<SymbolDerived>(sym)->getParentSymbol());
|
|
break;
|
|
case SymExpr::ExtentKind:
|
|
KnownLive = isLiveRegion(cast<SymbolExtent>(sym)->getRegion());
|
|
break;
|
|
case SymExpr::MetadataKind:
|
|
KnownLive = MetadataInUse.count(sym) &&
|
|
isLiveRegion(cast<SymbolMetadata>(sym)->getRegion());
|
|
if (KnownLive)
|
|
MetadataInUse.erase(sym);
|
|
break;
|
|
case SymExpr::SymIntKind:
|
|
KnownLive = isLive(cast<SymIntExpr>(sym)->getLHS());
|
|
break;
|
|
case SymExpr::IntSymKind:
|
|
KnownLive = isLive(cast<IntSymExpr>(sym)->getRHS());
|
|
break;
|
|
case SymExpr::SymSymKind:
|
|
KnownLive = isLive(cast<SymSymExpr>(sym)->getLHS()) &&
|
|
isLive(cast<SymSymExpr>(sym)->getRHS());
|
|
break;
|
|
case SymExpr::CastSymbolKind:
|
|
KnownLive = isLive(cast<SymbolCast>(sym)->getOperand());
|
|
break;
|
|
}
|
|
|
|
if (KnownLive)
|
|
markLive(sym);
|
|
|
|
return KnownLive;
|
|
}
|
|
|
|
bool
|
|
SymbolReaper::isLive(const Stmt *ExprVal, const LocationContext *ELCtx) const {
|
|
if (LCtx == 0)
|
|
return false;
|
|
|
|
if (LCtx != ELCtx) {
|
|
// If the reaper's location context is a parent of the expression's
|
|
// location context, then the expression value is now "out of scope".
|
|
if (LCtx->isParentOf(ELCtx))
|
|
return false;
|
|
return true;
|
|
}
|
|
|
|
// If no statement is provided, everything is this and parent contexts is live.
|
|
if (!Loc)
|
|
return true;
|
|
|
|
return LCtx->getAnalysis<RelaxedLiveVariables>()->isLive(Loc, ExprVal);
|
|
}
|
|
|
|
bool SymbolReaper::isLive(const VarRegion *VR, bool includeStoreBindings) const{
|
|
const StackFrameContext *VarContext = VR->getStackFrame();
|
|
|
|
if (!VarContext)
|
|
return true;
|
|
|
|
if (!LCtx)
|
|
return false;
|
|
const StackFrameContext *CurrentContext = LCtx->getCurrentStackFrame();
|
|
|
|
if (VarContext == CurrentContext) {
|
|
// If no statement is provided, everything is live.
|
|
if (!Loc)
|
|
return true;
|
|
|
|
if (LCtx->getAnalysis<RelaxedLiveVariables>()->isLive(Loc, VR->getDecl()))
|
|
return true;
|
|
|
|
if (!includeStoreBindings)
|
|
return false;
|
|
|
|
unsigned &cachedQuery =
|
|
const_cast<SymbolReaper*>(this)->includedRegionCache[VR];
|
|
|
|
if (cachedQuery) {
|
|
return cachedQuery == 1;
|
|
}
|
|
|
|
// Query the store to see if the region occurs in any live bindings.
|
|
if (Store store = reapedStore.getStore()) {
|
|
bool hasRegion =
|
|
reapedStore.getStoreManager().includedInBindings(store, VR);
|
|
cachedQuery = hasRegion ? 1 : 2;
|
|
return hasRegion;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
return VarContext->isParentOf(CurrentContext);
|
|
}
|
|
|
|
SymbolVisitor::~SymbolVisitor() {}
|